WiFi CSP

Article
01/18/2024

The WiFi configuration service provider provides the functionality to add or delete Wi-Fi networks on a Windows device. The configuration service provider accepts SyncML input and converts it to a network profile that is installed on the device. This profile enables the device to connect to the Wi-Fi network when it's in range.

Programming considerations:

If the authentication method needs a certificate, for example, EAP-TLS requires client certificates, you must configure it through the CertificateStore configuration service provider. The WiFi configuration service provider doesn't provide that functionality; instead, the Wi-Fi profile can specify characteristics of the certificate to be used for choosing the right certificate for that network. The server must successfully enroll the certificate first before deploying the Wi-Fi network configuration. For example, for an EAP-TLS profile, the server must successfully configure and enroll the required client certificate before deploying the Wi-Fi profile. Self-signed certificate works for EAP-TLS/PEAP-MSCHAPv2, but it isn't supported in EAP-TLS.
For WEP, WPA, and WPA2-based networks, include the passkey in the network configuration in plaintext. The passkey is encrypted automatically when it's stored on the device.
The SSID of the Wi-Fi network part of the LocURI node must be a valid URI based on RFC 2396. This condition requires that all non-ASCII characters must be escaped using a %-character. Unicode characters without the necessary escaping aren't supported.
The <name>name_goes_here</name>\<SSIDConfig> must match <SSID><name>name_goes_here</name></SSID>.
For the WiFi CSP, you can't use the Replace command unless the node already exists.
Using ProxyPacUrl or ProxyWPAD in Windows 10 client editions (Home, Pro, Enterprise, and Education) will result in failure.

The following list shows the WiFi configuration service provider nodes:

./Device/Vendor/MSFT/WiFi
- Profile
  - {SSID}
    - ProfileSource
    - Proxy
    - ProxyPacUrl
    - ProxyWPAD
    - WiFiCost
    - WlanXml
./User/Vendor/MSFT/WiFi
- Profile
  - {SSID}
    - ProfileSource
    - Proxy
    - ProxyPacUrl
    - ProxyWPAD
    - WiFiCost
    - WlanXml

Device/Profile

Scope	Editions	Applicable OS
✅ Device ✅ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/WiFi/Profile

Identifies the Wi-Fi network configuration. Each Wi-Fi network configuration is represented by a profile object. This network profile includes all the information required for the device to connect to that network - for example, the SSID, authentication and encryption methods and passphrase in case of WEP or WPA2 networks.

Description framework properties:

Property name	Property value
Format	`node`
Access Type	Get

Device/Profile/{SSID}

Scope	Editions	Applicable OS
✅ Device ✅ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/WiFi/Profile/{SSID}

The Profile name of the Wi-Fi network. This is added when WlanXml node is added and deleted when WlanXml is deleted.

Specifies the name of the Wi-Fi network (32 bytes maximum) to create, configure, query, or delete. The name is case sensitive and can be represented in ASCII.

SSID is the name of network you're connecting to, while Profile name is the name of the Profile that contains the WiFi settings information. If the Profile name isn't set right in the MDM SyncML, as per the information in the WiFi settings XML, it could lead to some unexpected errors. For example, <LocURI>./Vendor/MSFT/WiFi/Profile/<MUST BE NAME OF PROFILE AS PER WIFI XML>/WlanXml</LocURI>.

Description framework properties:

Property name	Property value
Format	`node`
Access Type	Add, Delete, Get, Replace
Dynamic Node Naming	ServerGeneratedUniqueIdentifier

Device/Profile/{SSID}/ProfileSource

Scope	Editions	Applicable OS
✅ Device ✅ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 11, version 22H2 [10.0.22621] and later

./Device/Vendor/MSFT/WiFi/Profile/{SSID}/ProfileSource

Allows for defining which administrative entity is setting this Wi-Fi profile. This can currently be set to either 0=Enterprise or 1=Mobile Operator.

Description framework properties:

Property name	Property value
Format	`int`
Access Type	Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Enterprise.
1	Mobile Operator.

Device/Profile/{SSID}/Proxy

Scope	Editions	Applicable OS
✅ Device ✅ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/WiFi/Profile/{SSID}/Proxy

Optional node. The format is url:port. Configuration of the network proxy (if any).

Description framework properties:

Property name	Property value
Format	`chr` (string)
Access Type	Add, Delete, Get, Replace

Device/Profile/{SSID}/ProxyPacUrl

Scope	Editions	Applicable OS
✅ Device ✅ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1607 [10.0.14393] and later

./Device/Vendor/MSFT/WiFi/Profile/{SSID}/ProxyPacUrl

Optional node. URL to the PAC file location.

Note

Don't use. Using this configuration in Windows 10 client editions will result in failure.

Description framework properties:

Property name	Property value
Format	`chr` (string)
Access Type	Add, Delete, Get, Replace

Device/Profile/{SSID}/ProxyWPAD

Scope	Editions	Applicable OS
✅ Device ✅ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1607 [10.0.14393] and later

./Device/Vendor/MSFT/WiFi/Profile/{SSID}/ProxyWPAD

Optional node. The presence of the field enables WPAD for proxy lookup.

Note

Don't use. Using this configuration in Windows 10 client editions will result in failure.

Description framework properties:

Property name	Property value
Format	`bool`
Access Type	Add, Delete, Get, Replace

Allowed values:

Value	Description
false	Disable WPAD for proxy lookup.
true	Enable WPAD for proxy lookup.

Device/Profile/{SSID}/WiFiCost

Scope	Editions	Applicable OS
✅ Device ✅ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1809 [10.0.17763] and later

./Device/Vendor/MSFT/WiFi/Profile/{SSID}/WiFiCost

Optional node. If the policy is active selecting one of the values from the following list will set the cost of WLAN connection for the Wi-Fi profile. (1:Unrestricted - unlimited connection, 2: Fixed - capacity constraints up to a certain data limit, 3: Variable - costed on per byte basic) Default behavior: Unrestricted.

Description framework properties:

Property name	Property value
Format	`int`
Access Type	Add, Delete, Get, Replace
Default Value	1

Allowed values:

Value	Description
1 (Default)	Unrestricted - unlimited connection.
2	Fixed - capacity constraints up to a certain data limit.
3	Variable - paid on per byte basic.

Device/Profile/{SSID}/WlanXml

Scope	Editions	Applicable OS
✅ Device ✅ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./Device/Vendor/MSFT/WiFi/Profile/{SSID}/WlanXml

XML describing the network configuration and follows Windows WLAN_profile schema.

Link to schema: https://msdn.microsoft.com/library/windows/desktop/ms707341(v=vs.85).aspx

The profile XML must be escaped, as shown in the examples below.

If it exists in the blob, the keyType and protected elements must come before keyMaterial, as shown in the example in WPA2-Personal Profile Sample.

Note

If you need to specify other advanced conditions, such as specifying criteria for certificates that can be used by the Wi-Fi profile, you can do so by specifying this through the EapHostConfig portion of the WlanXML. For more information, see EAP configuration.

Description framework properties:

Property name	Property value
Format	`chr` (string)
Access Type	Add, Delete, Get, Replace

User/Profile

Scope	Editions	Applicable OS
✅ Device ✅ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./User/Vendor/MSFT/WiFi/Profile

Description framework properties:

Property name	Property value
Format	`node`
Access Type	Get

User/Profile/{SSID}

Scope	Editions	Applicable OS
✅ Device ✅ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./User/Vendor/MSFT/WiFi/Profile/{SSID}

The Profile name of the Wi-Fi network. This is added when WlanXml node is added and deleted when WlanXml is deleted.

Specifies the name of the Wi-Fi network (32 bytes maximum) to create, configure, query, or delete. The name is case sensitive and can be represented in ASCII.

Description framework properties:

Property name	Property value
Format	`node`
Access Type	Add, Delete, Get, Replace
Dynamic Node Naming	ServerGeneratedUniqueIdentifier

User/Profile/{SSID}/ProfileSource

Scope	Editions	Applicable OS
✅ Device ✅ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 11, version 22H2 [10.0.22621] and later

./User/Vendor/MSFT/WiFi/Profile/{SSID}/ProfileSource

Allows for defining which administrative entity is setting this Wi-Fi profile. This can currently be set to either 0=Enterprise or 1=Mobile Operator.

Description framework properties:

Property name	Property value
Format	`int`
Access Type	Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Enterprise.
1	Mobile Operator.

User/Profile/{SSID}/Proxy

Scope	Editions	Applicable OS
✅ Device ✅ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./User/Vendor/MSFT/WiFi/Profile/{SSID}/Proxy

Optional node. The format is url:port. Configuration of the network proxy (if any).

Description framework properties:

Property name	Property value
Format	`chr` (string)
Access Type	Add, Delete, Get, Replace

User/Profile/{SSID}/ProxyPacUrl

Scope	Editions	Applicable OS
✅ Device ✅ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1607 [10.0.14393] and later

./User/Vendor/MSFT/WiFi/Profile/{SSID}/ProxyPacUrl

Optional node. URL to the PAC file location.

Note

Don't use. Using this configuration in Windows 10 client editions will result in failure.

Description framework properties:

Property name	Property value
Format	`chr` (string)
Access Type	Add, Delete, Get, Replace

User/Profile/{SSID}/ProxyWPAD

Scope	Editions	Applicable OS
✅ Device ✅ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1607 [10.0.14393] and later

./User/Vendor/MSFT/WiFi/Profile/{SSID}/ProxyWPAD

Optional node. The presence of the field enables WPAD for proxy lookup.

Note

Don't use. Using this configuration in Windows 10 client editions will result in failure.

Description framework properties:

Property name	Property value
Format	`bool`
Access Type	Add, Delete, Get, Replace

Allowed values:

Value	Description
false	Disable WPAD for proxy lookup.
true	Enable WPAD for proxy lookup.

User/Profile/{SSID}/WiFiCost

Scope	Editions	Applicable OS
✅ Device ✅ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1809 [10.0.17763] and later

./User/Vendor/MSFT/WiFi/Profile/{SSID}/WiFiCost

Description framework properties:

Property name	Property value
Format	`int`
Access Type	Add, Delete, Get, Replace
Default Value	1

Allowed values:

Value	Description
1 (Default)	Unrestricted - unlimited connection.
2	Fixed - capacity constraints up to a certain data limit.
3	Variable - paid on per byte basic.

User/Profile/{SSID}/WlanXml

Scope	Editions	Applicable OS
✅ Device ✅ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 1511 [10.0.10586] and later

./User/Vendor/MSFT/WiFi/Profile/{SSID}/WlanXml

XML describing the network configuration and follows Windows WLAN_profile schema.

Link to schema: https://msdn.microsoft.com/library/windows/desktop/ms707341(v=vs.85).aspx

The profile XML must be escaped, as shown in the examples below.

If it exists in the blob, the keyType and protected elements must come before keyMaterial, as shown in the example in WPA2-Personal Profile Sample.

Note

Description framework properties:

Property name	Property value
Format	`chr` (string)
Access Type	Add, Delete, Get, Replace

Examples

These XML examples show how to perform various tasks using OMA DM.

Add a network

The following example shows how to add PEAP-MSCHAPv2 network with SSID 'MyNetwork'.

<SyncML xmlns="SYNCML:SYNCML1.2">
  <SyncBody>
    <Atomic>
      <CmdID>301</CmdID>
      <Add>
        <CmdID>302</CmdID>
        <Item>
          <Target>
            <LocURI>./Vendor/MSFT/WiFi/Profile/MyNetwork/WlanXml</LocURI>
          </Target>
          <Meta>
            <Format xmlns="syncml:metinf">chr</Format>
          </Meta>
          <Data><?xml version="1.0"?><WLANProfile xmlns="http://contoso.com/networking/WLAN/profile/v1"><name>MyNetwork</name><SSIDConfig><SSID><hex>412D4D534654574C414E</hex><name>MyNetwork</name></SSID><nonBroadcast>false</nonBroadcast></SSIDConfig><connectionType>ESS</connectionType><connectionMode>manual</connectionMode><MSM><security><authEncryption><authentication>WPA2</authentication><encryption>AES</encryption><useOneX>true</useOneX></authEncryption><OneX xmlns="http://contoso.com/networking/OneX/v1"><authMode>user</authMode><EAPConfig><EapHostConfig xmlns="http://contoso.com/provisioning/EapHostConfig"><EapMethod><Type xmlns="http://contoso.com/provisioning/EapCommon">25</Type><VendorId xmlns="http://contoso.com/provisioning/EapCommon">0</VendorId><VendorType xmlns="http://contoso.com/provisioning/EapCommon">0</VendorType><AuthorId xmlns="http://contoso.com/provisioning/EapCommon">0</AuthorId></EapMethod><Config xmlns="http://contoso.com/provisioning/EapHostConfig"><Eap xmlns="http://contoso.com/provisioning/BaseEapConnectionPropertiesV1"><Type>25</Type><EapType xmlns="http://contoso.com/provisioning/MsPeapConnectionPropertiesV1"><ServerValidation><DisableUserPromptForServerValidation>true</DisableUserPromptForServerValidation><ServerNames></ServerNames></ServerValidation><FastReconnect>true</FastReconnect><InnerEapOptional>false</InnerEapOptional><Eap xmlns="http://contoso.com/provisioning/BaseEapConnectionPropertiesV1"><Type>26</Type><EapType xmlns="http://contoso.com/provisioning/MsChapV2ConnectionPropertiesV1"><UseWinLogonCredentials>false</UseWinLogonCredentials></EapType></Eap><EnableQuarantineChecks>false</EnableQuarantineChecks><RequireCryptoBinding>false</RequireCryptoBinding><PeapExtensions><PerformServerValidation xmlns="http://contoso.com/provisioning/MsPeapConnectionPropertiesV2">false</PerformServerValidation><AcceptServerName xmlns="http://contoso.com/provisioning/MsPeapConnectionPropertiesV2">false</AcceptServerName></PeapExtensions></EapType></Eap></Config></EapHostConfig></EAPConfig></OneX></security></MSM></WLANProfile> </Data>
        </Item>
      </Add>
    </Atomic>
    <Final/>
  </SyncBody>
</SyncML>

Query network profiles

The following example shows how to query Wi-Fi profiles installed on an MDM server.

<Get>
   <CmdID>301</CmdID>
   <Item>
      <Target>
         <LocURI>./Vendor/MSFT/WiFi/Profile</LocURI>
      </Target>
   </Item>
</Get>

The following example shows the response.

<Results>
   <CmdID>3</CmdID>
   <MsgRef>1</MsgRef>
   <CmdRef>301</CmdRef>
   <Item>
      <Source><LocURI>./Vendor/MSFT/WiFi/Profile</LocURI></Source>
      <Meta><Format xmlns="syncml:metinf">node</Format></Meta>
      <Data>TestWLAN1/TestWLAN2</Data>
   </Item>
</Results>

Remove a network

The following example shows how to remove a network with SSID 'MyNetwork' and no proxy. Removing all network authentication types is done in this same manner.

<Atomic>
  <CmdID>300</CmdID>
  <Delete>
    <CmdID>301</CmdID>
    <Item>
      <Target>
        <LocURI>./Vendor/MSFT/WiFi/Profile/MyNetwork/WlanXml</LocURI>
      </Target>
    </Item>
  </Delete>
</Atomic>

Add a network and certification authority for a server certificate

The following example shows how to add PEAP-MSCHAPv2 network with SSID 'MyNetwork' and root CA validation for server certificate.

<Atomic>
  <CmdID>300</CmdID>
  <Add>
    <CmdID>301</CmdID>
    <Item>
      <Target>
        <LocURI>./Vendor/MSFT/WiFi/Profile/MyNetwork/WlanXml</LocURI>
      </Target>
      <Meta>
        <Format xmlns="syncml:metinf">chr</Format>
      </Meta>
      <Data><?xml version="1.0"?><WLANProfile xmlns="http://www.microsoft.com/networking/WLAN/profile/v1"><name>MyNetwork</name><SSIDConfig><SSID><name>MyNetwork</name></SSID><nonBroadcast>false</nonBroadcast></SSIDConfig><connectionType>ESS</connectionType><connectionMode>manual</connectionMode><MSM><security><authEncryption><authentication>WPA2</authentication><encryption>AES</encryption><useOneX>true</useOneX></authEncryption><OneX xmlns="http://www.microsoft.com/networking/OneX/v1"><authMode>user</authMode><EAPConfig><EapHostConfig xmlns="http://www.microsoft.com/provisioning/EapHostConfig"><EapMethod><Type xmlns="http://www.microsoft.com/provisioning/EapCommon">25</Type><VendorId xmlns="http://www.microsoft.com/provisioning/EapCommon">0</VendorId><VendorType xmlns="http://www.microsoft.com/provisioning/EapCommon">0</VendorType><AuthorId xmlns="http://www.microsoft.com/provisioning/EapCommon">0</AuthorId></EapMethod><Config xmlns="http://www.microsoft.com/provisioning/EapHostConfig"><Eap xmlns="http://www.microsoft.com/provisioning/BaseEapConnectionPropertiesV1"><Type>25</Type><EapType xmlns="http://www.microsoft.com/provisioning/MsPeapConnectionPropertiesV1"><ServerValidation><DisableUserPromptForServerValidation>true</DisableUserPromptForServerValidation><ServerNames></ServerNames><TrustedRootCA> InsertCertThumbPrintHere </TrustedRootCA></ServerValidation><FastReconnect>true</FastReconnect><InnerEapOptional>false</InnerEapOptional><Eap xmlns="http://www.microsoft.com/provisioning/BaseEapConnectionPropertiesV1"><Type>26</Type><EapType xmlns="http://www.microsoft.com/provisioning/MsChapV2ConnectionPropertiesV1"><UseWinLogonCredentials>false</UseWinLogonCredentials></EapType></Eap><EnableQuarantineChecks>false</EnableQuarantineChecks><RequireCryptoBinding>false</RequireCryptoBinding><PeapExtensions><PerformServerValidation xmlns="http://www.microsoft.com/provisioning/MsPeapConnectionPropertiesV2">true</PerformServerValidation><AcceptServerName xmlns="http://www.microsoft.com/provisioning/MsPeapConnectionPropertiesV2">false</AcceptServerName></PeapExtensions></EapType></Eap></Config></EapHostConfig></EAPConfig></OneX></security></MSM></WLANProfile> </Data>
    </Item>
  </Add>
</Atomic>

Configuration service provider reference

WiFi CSP

Device/Profile

Device/Profile/{SSID}

Device/Profile/{SSID}/ProfileSource

Device/Profile/{SSID}/Proxy

Device/Profile/{SSID}/ProxyPacUrl

Device/Profile/{SSID}/ProxyWPAD

Device/Profile/{SSID}/WiFiCost

Device/Profile/{SSID}/WlanXml

User/Profile

User/Profile/{SSID}

User/Profile/{SSID}/ProfileSource

User/Profile/{SSID}/Proxy

User/Profile/{SSID}/ProxyPacUrl

User/Profile/{SSID}/ProxyWPAD

User/Profile/{SSID}/WiFiCost

User/Profile/{SSID}/WlanXml

Examples

Add a network

Query network profiles

Remove a network

Add a network and certification authority for a server certificate

Feedback

Feedback

Additional resources

WiFi CSP

Device/Profile

Device/Profile/{SSID}

Device/Profile/{SSID}/ProfileSource

Device/Profile/{SSID}/Proxy

Device/Profile/{SSID}/ProxyPacUrl

Device/Profile/{SSID}/ProxyWPAD

Device/Profile/{SSID}/WiFiCost

Device/Profile/{SSID}/WlanXml

User/Profile

User/Profile/{SSID}

User/Profile/{SSID}/ProfileSource

User/Profile/{SSID}/Proxy

User/Profile/{SSID}/ProxyPacUrl

User/Profile/{SSID}/ProxyWPAD

User/Profile/{SSID}/WiFiCost

User/Profile/{SSID}/WlanXml

Examples

Add a network

Query network profiles

Remove a network

Add a network and certification authority for a server certificate

Related articles

Feedback

Feedback

Additional resources